fix: consistent case-insensitive email check in GET /projects/:projectId

From the PR description

Summary

• GET /projects/:projectId was using a case-sensitive Array.includes() to check shared_with, while every other access check is case-insensitive; this denied access to legitimate shared users whose stored email had different casing
• GET /projects list query was using the raw (un-normalized) user email in the shared_with contains filter, also causing missed results for mixed-case emails
• POST /projects was storing shared_with emails without normalization; PATCH already normalized - now both are consistent
• Extracted normalizeSharedWith and emailInSharedWith helpers to a new projectAccess.ts module for reuse and testability

Closes #70 Closes #85 Closes #93

Changes

• backend/src/lib/projectAccess.ts - new normalizeSharedWith and emailInSharedWith helpers
• backend/src/routes/projects.ts - GET list query uses normalized email; GET access check uses emailInSharedWith; POST normalizes shared_with via normalizeSharedWith
• backend/src/lib/__tests__/projectEmailNormalization.test.ts - 8 unit tests

Test plan

• Unit tests: lowercase, dedup, drop empties, case-insensitive lookup, null/undefined email
• Build and typecheck pass